Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's Encrypt: How It Works

letsencrypt.org

Post reply on HN
Print view View original

71–80 of 123 posts

Re: Let's Encrypt: How It Works

#71

Post by ZoFreX »

Animats wrote: post #13

Keep track of when your certificate is going to expire, and automatically renew it. Or, all you have to do is let this new piece of software run periodically on your secure server. What could possibly go wrong?

It's a balance, at the end of the day. I won't be auto-updating on my server because it's not hard for me to do that myself. But if someone is just running a site where HTTPS isn't particularly important (a personal blog, say) then the convenience might outweigh the very slight security concern - better they are using HTTPS at all, if the alternative to convenience is HTTP.

Re: Let's Encrypt: How It Works

#72

Post by grey-area »

adamtj wrote: post #67
tedunangst wrote: post #21

Unfortunate choice of wording. From the web page: > Obtain a browser-trusted certificate and set it up on your web server From the "RFC" on github: > In the background, the web server contacts the CA and uses ACME to request that a certificate be issued for the intended domain name(s). > Once the CA is satisfied, the certificate is issued and the web server automatically downloads and installs it, potentially notifyi…

They're generating the certificate, not the keys. Those are different things. You can probably think of the certificate as the computer equivalent of photo ID for the server. They both show who you are (Driver's License: your name, cert: hostname), what you look like (DL: photo of you, cert: the key's fingerprint) and provide proof that they are genuine (DL: difficult and illegal fake, cert: practically impossible to…

Looks to me like it generates the keys locally OR you can specify the keys if you like. But since the private key doesn't leave your server, it doesn't really matter either way.

https://github.com/letsencrypt/lets-encrypt-preview/blob/mas...

Re: Let's Encrypt: How It Works

#73

Post by bifurcation »

grey-area wrote: post #65

Great project to smooth out the really painful process at present for acquiring certs. How about an FAQ page or a few clarifications? Things I wanted to know which were not immediately apparent: Will it be broadly accepted from day one? Yes, apparently, though see the identrust issue below. Will it generate a keypair but keep the private key on your server? Yes. Will it work without having to babysit an interactive p…

We're working on an FAQ. This thread has been really helpful in clarifying which Qs are FA :)

With regard to your questions:

> Will it provide wildcard certs?

Not initially, but possibly in a future iteration.

Note that having an automatic CA addresses some of the use cases for wildcard certs. Namely, if you're using a wildcard cert just to avoid having to manage individual certs for foo-1.example.com through foo-N.example.com, you can just have them each automatically get a specific cert.

> How does it auto-renew, does it have to run all the time?

That will depend on the software running on the web server. The current "node-acme" and "lets-encrypt-preview" implementations in the Github repo are examples. Ultimately, in addition to these tools, it would be great to have ACME / LE support built into web server platforms, which are already running all the time.

> Why is the cert for identrustssl not trusted in Chrome or Safari? That doesn't inspire confidence : https://www.identrustssl.com/

I don't know what the story is with that site, but I believe the Let's Encrypt CA will be cross-signed under the same IdenTrust CA that issued the cert for https://letsencrypt.org/. So Let's Encrypt certificates should work wherever that site works (which includes Chrome and Safari, at least on my MacBook).

> Can every CA support issuing certs this way please? :)

I can't speak for other CAs, but we are definitely open to other CAs re-using technologies from Let's Encrypt to automate their operations. It would be even better for them to collaborate in developing the protocol. That's why we wrote ACME up using the IETF's document format, so that it can be developed in the IETF's open process with many stakeholders involved.

Re: Let's Encrypt: How It Works

#74

Post by ecoffey »

adamtj wrote: post #67
tedunangst wrote: post #21

Unfortunate choice of wording. From the web page: > Obtain a browser-trusted certificate and set it up on your web server From the "RFC" on github: > In the background, the web server contacts the CA and uses ACME to request that a certificate be issued for the intended domain name(s). > Once the CA is satisfied, the certificate is issued and the web server automatically downloads and installs it, potentially notifyi…

They're generating the certificate, not the keys. Those are different things. You can probably think of the certificate as the computer equivalent of photo ID for the server. They both show who you are (Driver's License: your name, cert: hostname), what you look like (DL: photo of you, cert: the key's fingerprint) and provide proof that they are genuine (DL: difficult and illegal fake, cert: practically impossible to…

The driver license analogy is pretty great, I'll be stealing that :-)

Re: Let's Encrypt: How It Works

#75

Post by ivok »

bifurcation wrote: post #32
grecy wrote: post #3

Sorry for the newbie question.... So if I have apache running http://example.com on port 80 and I follow the instructions ($ lets-encrypt example.com) Will Apache now be correctly serving encrypted traffic on port 443 with a cert for https://example.com ?

The ultimate vision is to make it even easier than that -- you set the "turn on HTTPS" option, and the platform auto-configures HTTPS with a certificate and appropriate ciphers. That will require upgrades to apache, nginx, IIS, etc., though, so in the meantime, we have the "lets-encrypt" script to semi-automate things.

So going from a single command to a different single command? How much simpler could it get?

Re: Let's Encrypt: How It Works

#77

Post by mike-cardwell »

Simucal wrote: post #10

What kind of impact is Let's Encrypt going to have on the CA industry? I'm not that familiar with the current state of the CA companies, nor do I understand this industry well enough to know if this is going to be a major hit to them or not. Is there any reason why a company would prefer a CA other than Let's Encrypt?

It will cost existing CAs a lot of business. We already had free certs from StartSSL, but they were for non-commercial purposes only.

I imagine a lot of shared hosting companies who currently resell SSL certs to their own customers will be switching to this next year.

I will certainly use them, and will only recommend them and nobody else. The only reason I'd ever look at one of the old CAs now, is for EV certs. But 99% of the time, people don't need an EV cert.

Re: Let's Encrypt: How It Works

#78

Post by grey-area »

bifurcation wrote: post #73
grey-area wrote: post #65

Great project to smooth out the really painful process at present for acquiring certs. How about an FAQ page or a few clarifications? Things I wanted to know which were not immediately apparent: Will it be broadly accepted from day one? Yes, apparently, though see the identrust issue below. Will it generate a keypair but keep the private key on your server? Yes. Will it work without having to babysit an interactive p…

We're working on an FAQ. This thread has been really helpful in clarifying which Qs are FA :) With regard to your questions: > Will it provide wildcard certs? Not initially, but possibly in a future iteration. Note that having an automatic CA addresses some of the use cases for wildcard certs. Namely, if you're using a wildcard cert just to avoid having to manage individual certs for foo-1.example.com through foo-N.e…

Not initially, but possibly in a future iteration.

OK, good to know.

Ultimately, in addition to these tools, it would be great to have ACME / LE support built into web server platforms, which are already running all the time.

I see, thanks, hence the emphasis on protocol not product. Great idea, let's hope it takes off, it'd be really nice to be able to just add a config for ssl_on and let the server deal with the rest. I suppose it's early days for discussions with server providers?

I don't know what the story is with that site

It's weird how old and busted CA sites are, almost without exception, I guess I shouldn't be surprised that a place selling certs doesn't even use them properly, but as you point out, they've issued letsencrypt.org, and that works fine. Good to know.

So Let's Encrypt certificates should work wherever that site works

This would be a great line for your how it works, rather than browser-trusted, which could mean anything really.

Thanks again for this great idea, looking forward to trying it out.

Re: Let's Encrypt: How It Works

#79

Post by ultramancool »

mike-cardwell wrote: post #77
Simucal wrote: post #10

What kind of impact is Let's Encrypt going to have on the CA industry? I'm not that familiar with the current state of the CA companies, nor do I understand this industry well enough to know if this is going to be a major hit to them or not. Is there any reason why a company would prefer a CA other than Let's Encrypt?

It will cost existing CAs a lot of business. We already had free certs from StartSSL, but they were for non-commercial purposes only. I imagine a lot of shared hosting companies who currently resell SSL certs to their own customers will be switching to this next year. I will certainly use them, and will only recommend them and nobody else. The only reason I'd ever look at one of the old CAs now, is for EV certs. But…

It's very, very hard for traditional CAs to compete with free, trusted in all major platforms and with dead simple set up. Hopefully this sort of scheme, combined with the added trust of Certificate Transparency, can kill off most traditional CAs.

The only reason I would still buy 1 certificate is for wildcard support.

Re: Let's Encrypt: How It Works

#80

Post by RaleyField »

raesene3 wrote: post #54
sbierwagen wrote: post #49

Earlier quoted context omitted.

It doesn't issue EV certs, so the business model for traditional CAs will be those.

I don't think EV SSL certificates have been a big success (though that's just a personal opinion rather something backed with specific data) For me the differentiation in the browser presentation of EV against ordinary SSL doesn't provide much additional security. Most users don't notice the difference and even if they do, wouldn't remember which sites had an EV certificate, such that they would notice it changing ba…

I wouldn't login to my bank's website if it didn't present me with green EV url bar. Same with paypal, amazon and basically anything to do with money has to have EV for me. I might be slightly paranoid, but I thought the point of ssl was EV.
Post reply on HN